.goreleaser.yaml

#
# Example keyless signing with SBOMs goreleaser config.
#
# See also: .github/workflows/release.yml

version: 2

project_name: cubx

# setups builds for linux and darwin on amd64 and arm64
# https://goreleaser.com/customization/build
builds:
  - env:
      - CGO_ENABLED=0
    goos:
      - linux
      - darwin
    goarch:
      - amd64
      - arm64
    # ensures mod timestamp to be the commit timestamp
    mod_timestamp: "{{ .CommitTimestamp }}"
    flags:
      # trims path
      - -trimpath
    ldflags:
      # use commit date instead of current date as main.date
      # only needed if you actually use those things in your main package, otherwise can be ignored.
      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{ .CommitDate }}

archives:
  - format_overrides:
      - goos: windows
        format: zip
    name_template: >-
      {{ .ProjectName }}_
      {{- .Version }}_
      {{- title .Os }}_
      {{- if eq .Arch "amd64" }}x86_64
      {{- else if eq .Arch "386" }}i386
      {{- else }}{{ .Arch }}{{ end }}
    wrap_in_directory: true
    files:
      - README*
      - LICENSE*
      - docs/*

# proxies from the go mod proxy before building
# https://goreleaser.com/customization/gomod
gomod:
  proxy: true

# config the checksum filename
# https://goreleaser.com/customization/checksum
checksum:
  name_template: "checksums.txt"

# create a source tarball
# https://goreleaser.com/customization/source/
source:
  enabled: true

# creates SBOMs of all archives and the source tarball using syft
# https://goreleaser.com/customization/sbom
sboms:
  - artifacts: archive
  - id: source # Two different sbom configurations need two different IDs
    artifacts: source

# signs the checksum file
# all files (including the sboms) are included in the checksum, so we don't need to sign each one if we don't want to
# https://goreleaser.com/customization/sign
signs:
  - cmd: cosign
    env:
      - COSIGN_EXPERIMENTAL=1
    certificate: "${artifact}.pem"
    args:
      - sign-blob
      - "--output-certificate=${certificate}"
      - "--output-signature=${signature}"
      - "${artifact}"
      - "--yes" # needed on cosign 2.0.0+
    artifacts: checksum
    output: true